typed arrays: copy non-ArrayBuffer in DataView ctor

This is commit 01ee551, except for the DataView type this time.

Make the behavior of DataView consistent with that of typed arrays:
make a copy of the backing store.

2 files changed, 28 insertions, 4 deletions

diff --git a/src/v8_typed_array.cc b/src/v8_typed_array.cc
index 6efb4aed7..9dd16d76b 100644
--- a/src/v8_typed_array.cc
+++ b/src/v8_typed_array.cc
@@ -681,12 +681,24 @@ class DataView {
     }
 
     void* buf = buffer->GetIndexedPropertiesExternalArrayData();
+    char* dst = NULL;
+    if (ArrayBuffer::HasInstance(buffer)) {
+      dst = reinterpret_cast<char*>(buf) + byte_offset;
+    } else {
+      // Make a copy. A violation of the spec but we're not supposed
+      // to accept typed arrays anyway, only ArrayBuffers.
+      dst = static_cast<char*>(malloc(byte_length));
+      if (dst == NULL) return ThrowError("Out of memory.");
+      memcpy(dst, buf, byte_length);
+      v8::V8::AdjustAmountOfExternalAllocatedMemory(byte_length);
+      v8::Persistent<v8::Object>::New(args.This()).MakeWeak(NULL, WeakCallback);
+    }
 
     // Like ArrayBuffer, we violate the spec and add an operator[].
-    args.This()->SetIndexedPropertiesToExternalArrayData(
-        reinterpret_cast<char*>(buf) + byte_offset,
-        v8::kExternalUnsignedByteArray, byte_length);
-
+    v8::ExternalArrayType array_type = v8::kExternalUnsignedByteArray;
+    args.This()->SetIndexedPropertiesToExternalArrayData(dst,
+                                                         array_type,
+                                                         byte_length);
     args.This()->Set(v8::String::New("buffer"),
                      buffer,
                      (v8::PropertyAttribute)(v8::ReadOnly|v8::DontDelete));
diff --git a/test/simple/test-typed-arrays.js b/test/simple/test-typed-arrays.js
index ed9cc33c6..e0884fe88 100644
--- a/test/simple/test-typed-arrays.js
+++ b/test/simple/test-typed-arrays.js
@@ -234,3 +234,15 @@ assert.throws(function() {
   assert.equal(a[0], 1);
   assert.equal(b[0], 1);
 })();
+
+(function() {
+  // DataView of typed array should make a copy. This is a minor violation
+  // of the spec because the DataView constructor is supposed to accept
+  // ArrayBuffers only.
+  var a = new Uint8Array(1);
+  var b = new DataView(a);
+  a[0] = 0;
+  b[0] = 1;
+  assert.equal(a[0], 0);
+  assert.equal(b[0], 1);
+})();